• 1. Definitions and interpretation
• 2. Acceptance and formation
• 3. Grant of licence
• 4. Account roles and responsibility
• 5. Commercial terms and pricing
• 6. Availability and support
• 7. Security
• 8. Backups and data portability
• 9. Data protection and privacy (processor terms)
• 10. Acceptable use
• 11. Third-party services and bank feeds
• 12. AI and beta features
• 13. Intellectual property and feedback
• 14. Professional advice, compliance and where DARITHMA fits
• 15. Confidentiality
• 16. Suspension and termination
• 17. Consumer matters
• 18. Export controls and sanctions
• 19. Changes to the service and terms
• 20. Warranties and disclaimers
• 21. Exclusions of liability
• 22. Indemnities
• 23. Limitation of liability
• 24. Force majeure
• 25. Notices
• 26. Assignment and subcontracting
• 27. Precedence, severability, waiver, relationship
• 28. Governing law and jurisdiction
• 29. Entire agreement
• 30. Consent prior to use
• Annex A — Data Processing Addendum
• Annex B — Technical and Organisational Measures
• Annex C — Privacy Policy
• Annex D — Model Withdrawal Form

This End User Licence Agreement and Terms of Use (the “Agreement”) is entered into between:

(i) DARITHMA LTD, a private limited liability company incorporated and validly existing under the laws of the Republic of Cyprus, registration number HE476166, tax identification number 60181289B, with registered office at Gerolakkou Avenue 6A, 8540 Paphos, Cyprus (the “Licensor”); and

(ii) the Customer,

(together the “Parties” and each a “Party”).

WHEREAS:

A. The Licensor develops, operates and licenses DARITHMA, an accounting, invoicing, VAT and payroll software, which is made available (a) as a hosted service used through a web browser (“DARITHMA Cloud”) and (b) as software installed on the Customer’s own computer (“DARITHMA Desktop”).

B. The Customer wishes to access and use the Software subject to the terms of this Agreement.

C. DARITHMA is designed for businesses operating under the European Union’s VAT framework, with functions aligned with the accounting and tax environment of Cyprus (clause 14.3). The Licensor is established in Cyprus; disputes are governed in accordance with clause 28.

D. Prices, renewals and promotions are not set out in this Agreement. They are governed by the Subscription Terms and the order flow on the Website, or by specific written commercial terms agreed between the Licensor and the Customer (clause 5).

1. DEFINITIONS AND INTERPRETATION

1.1 In this Agreement the following terms have the following meaning:

“Business Day” means a day other than a Saturday, Sunday or official public holiday in the Republic of Cyprus, on which banks in Cyprus are generally open for business.

“Cloud Edition” or “DARITHMA Cloud” means the Software provided by the Licensor as a hosted service, on servers operated by or for the Licensor, and used through a web browser at https://app.darithma.com or any successor address.

“Controller” “Processor”, “Personal Data” and “Processing” have the meanings in Regulation (EU) 2016/679 (General Data Protection Regulation), as this may be amended from time to time.

“Customer” means the natural person, legal entity, public authority, agency or other body that (a) creates an account, (b) clicks to accept these terms on the Website or within the Software, (c) executes an Order Form or receives a Purchase Confirmation, (d) downloads, installs or otherwise accesses or uses the Software, and/or (e) pays any applicable fees, and by doing so agrees to be bound by this Agreement.

“Customer Data” means data, content and personal data entered into, uploaded to, stored in or generated by the Software (i) within the Customer’s tenant in the Cloud Edition, including each company database and its audit trail, or (ii) within the Customer’s own environment when the Desktop Edition is used, including any local databases.

“Desktop Edition” or “DARITHMA Desktop” means the Software installed and run on the Customer’s own computer(s), together with any installers, updates and licence files supplied for it (also called the “Desktop Software” or the “Downloadable Component”).

“Documentation” refers to the user guides, specifications, notices (including open-source notices), and policies published on the Website and/or provided as annexes to the Agreement.

“Invited User” means any individual the Subscriber (for the Cloud Edition) or the Customer (for the Desktop Edition) authorises to access or use the Software.

“Maintenance” means support, training, bug fixes and updates or new versions of the Desktop Edition that the Licensor has agreed in writing to provide, for the term so agreed.

“Order Form” means any order, checkout confirmation, quotation, proposal, subscription flow, invoice, email confirmation, plan terms presented on the Website, or other written or electronic communication issued by the Licensor (including through authorised resellers or partners) and accepted by the Customer by signature, click-through, electronic acceptance, payment, or other conduct amounting to acceptance, including a Purchase Confirmation. To the extent permitted by law, “Order Form” also includes any oral agreement that is contemporaneously recorded or confirmed in writing, by email, or by subsequent performance. Each Order Form is incorporated by reference and forms part of this Agreement.

“Purchase Confirmation” means the Licensor’s written confirmation of a Desktop Edition purchase and its commercial terms, which may be provided electronically and without signature (for example the invoice or receipt and the licence delivery email). It may specify the licence fee, any Maintenance and its fees, and the scope of permitted use (such as the edition, companies, users or devices). Each Purchase Confirmation is incorporated by reference and forms part of this Agreement.

“Software” or “Service” means the DARITHMA accounting software provided by the Licensor as the Cloud Edition or the Desktop Edition, including any downloadable clients, connectors or components made available by the Licensor, any online services provided with it (such as licence activation for the Desktop Edition), and any AI-assisted features and/or automations.

“Sub-processor” means a third party engaged by the Licensor to process Personal Data on behalf of the Customer.

“Subscriber” means the Customer that administratively controls a subscription.

“Subscription” means the time-limited licence and contractual entitlement granted under this Agreement whereby the Customer, as Subscriber, and its authorised Invited Users may access and use the Cloud Edition (and any related services), strictly in accordance with the features, quantities, roles, usage parameters and restrictions of the plan chosen, as specified at purchase, in the applicable Order Form, in the Subscription Terms or on the Website (including limits on companies, users per company, modules and usage). A Subscription begins on the date stated in the checkout confirmation (or, if earlier, when access is first provided), continues for successive billing periods, and is subject to renewal, suspension, modification or termination in accordance with this Agreement and the Subscription Terms. The Subscriber administers the Subscription and is responsible for the acts and omissions of Invited Users. For the avoidance of doubt, a one-time licence of the Desktop Edition is not a Subscription.

“Subscription Terms” means the commercial terms for the Cloud Edition published on the Website under “Subscription terms” (plans, prices, free trial, introductory discount, VAT, payment, plan changes, cancellation and refunds), as in force when the Customer subscribes or as later changed under clause 19.

“Third-Party Service” means any product, service, data feed, bank feed, connector, API, AI service or integration not developed by the Licensor but made available to interoperate with the Software, including a service used with the Customer’s own account or key (clause 12.4).

“Website” means https://darithma.com (including https://www.darithma.com) and any sub-pages on which the Licensor publishes Documentation, legal terms and offers.

1.2 Headings are for convenience only and do not affect interpretation. The singular includes the plural and vice versa. “Including” means “including without limitation”. References to laws include their Cyprus implementations and amendments. In the event of conflict, clause 27 applies.

2. ACCEPTANCE AND FORMATION

2.1 By ticking the acceptance box, creating an account, executing an Order Form or receiving a Purchase Confirmation, installing the Software, logging in, and/or accessing or using the Software, the Customer irrevocably acknowledges that it has read, understood, and accepted this Agreement, consents to electronic contracting and record-keeping (including click-through and click-wrap mechanisms), and requests immediate performance of the digital service. Where an individual accepts on behalf of an organisation, such individual represents and warrants that they possess full authority to bind that organisation, and in the absence of such authority or identification of an organisation, the individual shall be deemed the Customer and personally bound hereby. Acceptance or use of the Service by any Invited User shall be deemed acceptance by the Subscriber, who shall be liable for all acts and omissions of such Invited User in connection with the Service. The Customer further agrees that the Licensor’s system logs and records shall constitute prima facie evidence of the Customer’s acceptance of this Agreement and the date thereof.

2.2 If the Customer is a consumer, the Customer may withdraw from the contract within fourteen (14) days of its conclusion without giving any reason. By starting the free trial or otherwise using the Cloud Edition within that period, the consumer expressly requests that the service begins during the withdrawal period; if the consumer then withdraws, the consumer pays an amount proportionate to the service provided until the Licensor was informed of the withdrawal (nothing is due for the free trial). For the Desktop Edition, which is digital content not supplied on a tangible medium, the right of withdrawal is lost once the download or installation has begun with the consumer’s prior express consent and acknowledgement that the right is thereby lost. To withdraw, the consumer may use the model form in Annex D or send any clear statement to support@darithma.com. If the Customer does not agree to this Agreement, it must not use the Software.

2.3 If the Customer is a business, the person accepting represents and warrants authority to bind the Customer.

2.4 The Licensor keeps a record of each acceptance of this Agreement, including at sign-up and at each sign-in (the version accepted, the date and time, the IP address and the browser details).

3. GRANT OF LICENCE

3.1 The Licensor grants the Customer a limited, non-exclusive, non-transferable, revocable licence to access and use the Software during the authorised term solely for the Customer’s internal business purposes and in accordance with this Agreement, the Documentation, any applicable Order Form or Purchase Confirmation and applicable law.

3.2 Use must remain within user, feature and usage parameters stated on the Website, in the Documentation or in the applicable Order Form or Purchase Confirmation (for the Cloud Edition, including the number of companies and of users per company of the Customer’s plan).

3.3 The Cloud Edition is used through a web browser and is not limited by a number of devices; its use is limited by the companies and users per company of the Customer’s plan. The Desktop Edition may be installed and run on the number of computers stated in the Purchase Confirmation (one computer unless stated otherwise), and each licence may be bound to its computer by a hardware identifier.

3.4 The Customer shall not resell, sublicense, time-share, permit third-party access (except Invited Users), copy except as permitted by law, reverse engineer where such restriction is lawful, remove proprietary notices, circumvent technical controls, or use the Software to build or assist a competing service.

3.5 If APIs are provided, usage is subject to any keys, rate limits and policies in the Documentation and may be suspended for abuse, security or legal reasons, in each case subject to clause 23.

4. ACCOUNT ROLES AND RESPONSIBILITY

4.1 The Subscriber (or, for the Desktop Edition, the Customer) controls the subscription or licence and sets Invited User permissions.

4.2 The Subscriber is responsible for all actions of Invited Users, maintaining accurate account information, enabling appropriate security configurations and promptly removing access for departed users.

4.3 Subject to clause 23, the Licensor has no liability for the Customer’s configuration or access-management decisions.

5. COMMERCIAL TERMS AND PRICING

5.1 This Agreement contains no prices, fees, charges, renewal mechanics or discounts.

5.2 All monetary and commercial terms are those published on the Website (for the Cloud Edition, the Subscription Terms) and/or stated in an Order Form, a Purchase Confirmation or another written commercial agreement between the Licensor and the Customer, and are incorporated by reference.

5.3 Prices exclude VAT unless stated otherwise. VAT and any other applicable taxes are calculated and charged as communicated at checkout, on the Order Form or Purchase Confirmation or in written commercial terms, on the basis of the billing address and VAT number provided by the Customer. The Customer is responsible for providing correct details and for keeping them up to date.

5.4 The Cloud Edition is provided on a subscription basis. Unless the Subscription Terms or an Order Form state otherwise: (a) a new subscription starts with a free trial; (b) fees are charged in advance for each monthly billing period to the payment card provided, through the Licensor’s payment provider; (c) the subscription renews automatically for successive billing periods until cancelled; (d) the Subscriber may change plan or cancel at any time online, with the effects described in the Subscription Terms; and (e) introductory discounts apply only as stated in the Subscription Terms. The Licensor does not receive or store full payment card details.

5.5 The Desktop Edition is supplied only by written arrangement with the Licensor, normally after a personal demonstration, and is not sold online. The licence granted under clause 3 includes the right to install and run the Desktop Edition, whether by download or by direct installation on the Customer’s systems, within the limits of clause 3.3 and the Purchase Confirmation. Unless the Purchase Confirmation states otherwise, the fees for the Desktop Edition consist of a one-time, upfront licence fee (the “Initial Licence Fee”) and, only if agreed in writing, a fee for Maintenance for the term so agreed. Without Maintenance the Customer may continue to use the version supplied under the licence, but the Licensor is not obliged to provide support, training, bug fixes or new versions. If the Initial Licence Fee is not paid when due, the Licensor may withhold or revoke the licence file. The Customer acknowledges that the Desktop Edition is operated in the Customer’s own environment and therefore does not include server-side security, monitoring, backups, redundancy, disaster recovery, availability commitments, data retention or recovery, or other infrastructure-level protections or service levels. The Customer is exclusively responsible for its local environment (including hardware, operating system, database and networks), configurations, access management, updates and patching, malware protection, encryption at rest, backup and restore, business continuity and compliance. To the maximum extent permitted by law, the Desktop Edition (and any Maintenance deliverables) is provided “as is” and “as available”, and the Licensor does not warrant that it will be uninterrupted or error-free in the Customer’s environment. For the Desktop Edition, clause 6 applies to support and to making installers and updates available, and clauses 7 to 9 and Annex A apply only to the extent the Licensor processes Personal Data in providing support, Maintenance or licence activation. Without limiting clause 22, the Customer shall indemnify, defend and hold harmless the Licensor, its affiliates and personnel from and against all losses, damages, costs, liabilities and claims (including reasonable legal fees) arising out of or in connection with (a) the Customer’s environment, configurations, integrations or third-party systems; (b) the Customer’s failure to implement appropriate security, backups or compliance; or (c) the Customer’s use of the Desktop Edition in breach of this Agreement.

5.6 For the Cloud Edition, fees for a billing period that has started are not refunded, including when the Subscriber cancels or moves to a smaller plan during that period, except as stated in the Subscription Terms (for example, amounts charged in error) or required by law. For the Desktop Edition, the Initial Licence Fee and fees for any elapsed part of a Maintenance term are non-refundable except as agreed in writing or required by law. For clarity and avoidance of doubt, the exclusions of liability in clause 21, the indemnities in clause 22 and the limitation of liability in clause 23 apply in full to both editions, Maintenance and related fees, and no additional or different warranties, service levels, data retention or continuity obligations shall be implied or arise by course of dealing, usage or trade.

5.7 If a payment for the Cloud Edition fails, it is retried by the payment provider and the Subscriber is notified, and the Customer may continue to use the Cloud Edition in the meantime. If payment cannot be collected, the subscription ends and access to the Customer’s companies is locked until a new subscription is taken out. Customer Data is kept as set out in clause 8.6.

6. AVAILABILITY AND SUPPORT

6.1 For the Cloud Edition, the Licensor will use commercially reasonable efforts to provide reliable access. Access may be interrupted for maintenance, updates, infrastructure changes or circumstances beyond reasonable control and, to the maximum extent permitted by law and subject to clause 23, the Licensor has no liability for any unavailability, interruption, delay or failure.

6.2 Unless expressly stated on an Order Form or in written commercial terms, no specific uptime commitment or service credits apply.

6.3 Planned maintenance may occur, typically off-peak, and the Licensor will endeavour to provide notice where practicable.

6.4 Support is provided by email (support@darithma.com) and through the support form on the Website; its scope and hours are described on the Website and may evolve, in each case subject to clause 23.

6.5 For the Desktop Edition, the Licensor will use commercially reasonable efforts to provide the support agreed in writing and to operate licence activation. The performance and availability of the Desktop Edition depend on the Customer’s local environment and third-party dependencies (hardware, operating system, database, networks and security controls), and any availability commitments apply only to the Cloud Edition.

7. SECURITY

7.1 For the Cloud Edition, the Licensor implements technical and organisational measures designed to protect the Service and Personal Data, including TLS encryption in transit, access controls with two-factor authentication for administrative access, a separate database for each company, patch management, logging and monitoring, and encrypted backups made daily and stored with a second, independent provider, with rolling retention (Annex B). No system is perfectly secure and incidents may occur; any obligations of the Licensor are subject to clause 23.

7.2 The Customer must maintain credential secrecy, adopt multi-factor authentication where available, manage permissions, secure its devices and networks, and refrain from storing sensitive data in free-form fields the Software does not explicitly request.

7.3 Subject to clause 23, the Licensor shall have no liability for failures by the Customer to implement reasonable security or follow the Documentation.

7.4 The Licensor does not host the Customer’s accounting database as part of the Desktop Edition. For the Desktop Edition, security depends primarily on the Customer’s local environment; the Customer is responsible for securing and maintaining its devices, networks and databases (including database configuration, access controls, patching and local backups) and for protecting user credentials. Any materials voluntarily provided for support (for example screenshots, logs or sample files) are used only to provide support and may be deleted when no longer needed.

8. BACKUPS AND DATA PORTABILITY

8.1 For the Cloud Edition, the Licensor operates periodic encrypted backups with rolling retention for disaster recovery; backups are not a substitute for the Customer’s exports.

8.2 For loss or corruption of Customer Data, the Licensor’s obligation is limited to taking reasonable steps to attempt recovery from available backups, subject to clause 23.

8.3 The company owner can download a backup of the company’s data from within the Cloud Edition, including after the subscription has ended while the Customer Data is kept (clause 8.6). On termination or upon written request, the Licensor will also make available reasonable means to export Customer Data within a reasonable period.

8.4 After any legally required retention, Customer Data will be deleted or irreversibly anonymised from active systems, with residual copies expiring per backup cycles.

8.5 Deletion from active systems will ordinarily complete within 30 days of confirmation and from backups within 90 days of the relevant cycle’s expiry, in each case subject to clause 23.

8.6 When a Cloud subscription ends, the Customer’s companies are locked but the Customer Data is not deleted automatically, so that the Customer can download it or subscribe again and continue. The Customer may ask for deletion at any time (clause 8.5). The Licensor may delete the Customer Data of a subscription that has ended after giving the Subscriber at least thirty (30) days’ notice by email.

8.7 For the Desktop Edition, Customer Data is stored locally. The Customer is solely responsible for backing it up, testing restores, keeping exports and records as the law requires, and for its deletion and retention; the Licensor has no ability and no obligation to recover locally stored data.

9. DATA PROTECTION AND PRIVACY (PROCESSOR TERMS)

9.1 For Customer Data, the Customer is the Controller and the Licensor is the Processor; for the Licensor’s own account, billing and website data, the Licensor is Controller. Processing as Processor will comply with the GDPR and Cyprus data protection framework; the competent supervisory authority in Cyprus is the Office of the Commissioner for Personal Data Protection. For the Desktop Edition, the Licensor does not host, access or receive Customer Data in ordinary use and acts as Controller only for the limited licensing, billing and support information described in Annex C.

9.2 The Licensor processes Personal Data in Customer Data only to provide, secure, support and operate the Service, including storage, transmission, display, backup, troubleshooting, monitoring and tenant-scoped improvements, for the Customer’s authorised term and until deletion in accordance with this Agreement.

9.3 Customer Data typically includes business-context Personal Data relating to the Customer’s personnel, customers, suppliers and contacts; the Customer shall not submit special-category or criminal-offence data unless expressly agreed in writing with appropriate safeguards.

9.4 The Licensor will act only on documented instructions from the Customer, including this Agreement, administrative settings and written support requests, and may decline or suspend Processing that appears unlawful, unclear or infeasible pending clarification, subject to clause 23.

9.5 The Licensor maintains appropriate technical and organisational measures having regard to the state of the art, costs and risks, and the Customer must implement appropriate configurations and review any logs or alerts made available within its tenant.

9.6 The Customer authorises the Licensor to engage Sub-processors for hosting and ancillary services. The current list is set out in Annex A, paragraph (viii), and summarised in the privacy notice on the Website. The Licensor will ensure Sub-processors are bound by written data-protection obligations no less protective than those set out in this Agreement. To the extent permitted by law, the Licensor’s responsibility for Sub-processors is limited to its obligations as Processor under Article 28 GDPR, and any liability arising from Sub-processors is subject to clause 23. The Licensor will provide at least 15 days’ prior notice of material Sub-processor changes and allow reasonable, good-faith objection; if unresolved, the Customer’s sole remedy is to terminate the affected service and receive a pro-rata refund of any prepaid fees for the remaining term.

9.7 Where Processing involves transfers outside the EEA/UK without an adequacy decision, the Parties rely on recognised transfer mechanisms, including the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, where applicable, the UK Addendum/IDTA, together with appropriate supplementary measures. For such transfers, these mechanisms prevail solely for the relevant transfers in case of conflict.

9.8 Unless prohibited by law, the Licensor will promptly forward to the Customer any regulatory inquiry or data-subject request relating to Customer Data; the Customer is responsible for responding as Controller, and the Licensor will reasonably assist within the Service’s capabilities and may charge reasonable cost-based fees for assistance beyond standard tooling, in each case subject to clause 23.

9.9 If the Licensor receives a legally binding demand for Customer Data, it may disclose to the extent required by law and will, where lawful and practicable, provide prior notice to the Customer.

9.10 Upon becoming aware of a Personal Data breach affecting Customer Data, the Licensor will notify the Customer without undue delay after confirmation and provide information reasonably available to support the Customer’s assessment and notifications; such notice is not an admission of fault or liability and is subject to clause 23.

9.11 The Licensor will make available information reasonably necessary to demonstrate compliance and will allow audits by the Customer or its mandated independent auditor on at least 30 days’ written notice, during normal business hours, no more than once in any 12-month period, and subject to confidentiality, safety and security requirements. The Licensor may first satisfy audit needs by providing then-current certifications, reports or responses to industry-standard security questionnaires; on-site components will be permitted only if remote or documentary review is insufficient. The Customer bears all audit costs and any Licensor out-of-pocket costs at reasonable rates, in each case subject to clause 23.

9.12 At the end of services or upon written request, the Licensor will delete or return Personal Data and delete existing copies, subject to legal retention. Deletion from backups occurs upon expiry of rolling cycles. Minimal business records and compliance evidence may be retained for legally permitted periods.

9.13 The Licensor may create and use aggregated or anonymised statistics derived from the Customer’s use for service improvement, security, reliability, analytics and development, provided such data does not identify the Customer or any data subject.

9.14 The limitations and cap in clause 23 apply to this clause to the fullest extent permitted by law and without prejudice to rights of data subjects where such limitation is not permitted.

10. ACCEPTABLE USE

10.1 The Customer shall not use the Service to store or transmit unlawful, harmful, infringing, defamatory, deceptive or misleading material; to send spam or malware; to attempt to gain unauthorised access; to probe, scan or test vulnerability without authorisation; to benchmark for competitive purposes; or to burden or disrupt the Service.

10.2 The Licensor may suspend or disable offending use without liability except as provided in clause 23.

10.3 The Customer remains responsible for its users’ compliance with this Agreement.

11. THIRD-PARTY SERVICES AND BANK FEEDS

11.1 The Software may interoperate with Third-Party Services, including bank feeds, account-information or payment-initiation services and tax or compliance add-ons; access and use may require acceptance of third-party terms and privacy policies, for which the Customer is solely responsible.

11.2 To the maximum extent permitted by law and subject to clause 23, the Licensor does not control and is not responsible for Third-Party Services, their security, availability, accuracy, fee policies or data practices, and makes no representation regarding continued availability, accuracy of balances, categorizations or transaction data; connections may fail, be delayed, be rate-limited, change or cease without liability of the Licensor.

11.3 Where required by law, any account-information or payment-initiation is provided by authorised third parties; the Licensor is not a bank, payment institution or e-money institution and does not hold customer funds.

12. AI AND BETA FEATURES

12.1 AI-assisted features or automations may be offered; outputs may be inaccurate or incomplete and must be reviewed by the Customer; such features are not professional advice.

12.2 Preview, trial or beta features are provided “as is”, may be suspended or withdrawn at any time and are not for production use; no service levels or credits apply.

12.3 To the maximum extent permitted by law and subject to clause 23, the Licensor has no liability arising from AI or beta features.

12.4 AI Document Reading in the Cloud Edition uses an artificial-intelligence service of a third party (at the date of this version, Google) through an API key that belongs to the Customer and is entered by the company owner. When the feature is used, the documents submitted are sent to that service under the Customer’s own account and agreement with the provider, which acts as the Customer’s own provider and not as a Sub-processor of the Licensor; the Customer is responsible for that agreement and its costs. The Licensor stores the key encrypted, applies usage limits, and does not keep the content of scanned documents in its logs.

13. INTELLECTUAL PROPERTY AND FEEDBACK

13.1 The Software, the Documentation, and all underlying and related technologies, architectures, databases, data models, schemas, interfaces, APIs, connectors, templates, configurations, algorithms, models (including AI/ML models), prompts, workflows, scripts, compilations, selections and arrangements, and all updates, upgrades, patches, fixes, enhancements and derivative works thereof (together, the “Licensor Materials”), and all intellectual property rights in and to the Licensor Materials (including patents, utility models, copyrights, database rights, design rights, trade secrets and know-how) are and shall remain the exclusive property of the Licensor and its licensors. The Customer acquires no right, title or interest in the Licensor Materials except the limited licence expressly granted in this Agreement; all rights not expressly granted are reserved. The Licensor Materials are licensed, not sold. For clarity, nothing in this clause transfers ownership of Customer Data.

13.2 No rights are granted by implication, estoppel or otherwise. Any configurations, parameter settings, mappings, forms, custom fields, reports, saved queries, dashboards or similar created within the Software constitute use of the Licensor Materials and do not create any intellectual property right in favour of the Customer in the Licensor Materials. To the extent the Licensor creates, adapts or delivers any modification, configuration, customisation or derivative of the Licensor Materials for or with the Customer, such work shall be deemed part of the Licensor Materials and owned exclusively by the Licensor, unless the Licensor expressly agrees otherwise in a signed writing.

13.3 Except to the limited extent mandatorily permitted by applicable law (and then only upon prior written notice to the Licensor and solely to the extent necessary to achieve such permitted interoperability), the Customer shall not, and shall not permit any third party to: (a) copy, frame, mirror, distribute, publish, disclose or display any Licensor Materials; (b) translate, adapt, modify, create derivative works of or otherwise alter any Licensor Materials; (c) reverse engineer, decompile or disassemble any Licensor Materials or attempt to derive source code, underlying ideas, algorithms or non-public APIs; (d) remove, obscure or alter any proprietary, attribution or technological-protection notices; (e) circumvent or attempt to circumvent access controls, usage limits, licence keys, seat controls, domain or tenant restrictions or other technical protections; (f) use the Licensor Materials to build, train or improve a product or service that is competitive with the Software, or for benchmarking, text-and-data mining, model training or competitive analysis, except as expressly permitted in writing by the Licensor; (g) scrape, harvest, bulk export or create datasets from the Licensor Materials or the outputs thereof; (h) use the Licensor Materials in violation of export control or sanctions laws or in high-risk systems where failure could lead to death or personal injury; or (i) claim, register or attempt to enforce any intellectual property right in or to the Licensor Materials.

13.4 The Licensor’s names, logos and product/service marks (the “Licensor Marks”) are the property of the Licensor. No right or licence to use the Licensor Marks is granted except for factual, truthful references to the Software in accordance with any published brand guidelines or with the Licensor’s prior written consent. The Customer shall not register, acquire or use any domain name, handle or identifier containing, or confusingly similar to, any Licensor Mark.

13.5 The Software may include third-party and/or open-source components. Such components are governed by their respective licences as identified in the Documentation or within the Software. To the extent of any conflict between such third-party/open-source licences and this Agreement in respect of the relevant component, the third-party/open-source licence shall prevail solely for that component. Subject to clause 23, the Licensor disclaims any warranty or liability in respect of third-party components, and the Customer is responsible for complying with applicable third-party licence terms.

13.6 The Licensor may collect and use telemetry, logs, diagnostics, performance data, usage statistics and related information about the operation and use of the Software (“Usage Data”) and may create and use aggregated and/or anonymised data derived from the Customer’s use (“Aggregated Data”) for purposes including security, support, billing verification, reliability, analytics, capacity planning, product improvement and development. Usage Data and Aggregated Data are Licensor Materials and do not include Customer-identifiable content; any processing of personal data within such data is subject to clause 9 to the limited extent clause 9 applies.

13.7 The Licensor (and/or its licensors) exclusively owns all right, title and interest in and to any AI/ML models, prompts, embeddings and related tooling used by or within the Software, including improvements derived from generalised learning across users. Any content generated by such features (“AI Output”) may be used by the Customer subject to this Agreement; the Customer remains solely responsible for verifying the accuracy, legality and fitness of AI Output for its purposes and for ensuring that its prompts and inputs do not infringe third-party rights. AI Output may be non-unique and similar or identical outputs may be generated for others. The Customer shall not use AI Output or prompts to train, fine-tune or otherwise improve models outside the Software without the Licensor’s prior written consent.

13.8 If the Customer or its users provide any suggestion, idea, correction, enhancement request, recommendation, code, sample, testimonial or other feedback relating to the Licensor Materials or the Service (“Feedback”), the Licensor may use, disclose, reproduce, license, distribute and exploit such Feedback without restriction or obligation. To the extent the Customer has or obtains any intellectual property right in the Feedback, the Customer hereby grants the Licensor a worldwide, perpetual, irrevocable, transferable, sublicensable, royalty-free licence to exercise all such rights and irrevocably waives (and shall procure the waiver of) any moral rights to the maximum extent permitted by law. Feedback is provided “as is”, without confidentiality obligations, attribution or compensation unless agreed in writing.

13.9 The Licensor (and its professional advisers) may verify the Customer’s compliance with the licence scope, usage parameters, seat limits and technical controls set out in this Agreement, the Website and/or the applicable Order Form or Purchase Confirmation. Verification may be performed remotely via available administrative tooling and logs, or, where remote verification is insufficient, on reasonable prior notice during normal business hours at the Customer’s premises. The Customer shall cooperate and promptly provide relevant records reasonably requested. If verification reveals unauthorised use, the Customer shall promptly pay applicable fees for the period of overuse at the then-current rates, plus reasonable verification costs if overuse exceeds five percent (5%), without prejudice to the Licensor’s other rights and remedies (including suspension or termination under clause 16). Amounts due are subject to clause 5.3 and the limitations in clause 23.

13.10 The Customer acknowledges that unauthorised use or disclosure of the Licensor Materials, breach of the restrictions in this clause 13, or violation of the Licensor’s intellectual property rights would cause irreparable harm for which monetary damages would be inadequate, and the Licensor is entitled to seek immediate injunctive and other equitable relief in any court of competent jurisdiction, without bond or other security, to prevent or curtail any actual or threatened breach.

13.11 This clause 13 survives termination or expiry of the Agreement. In the event of any conflict between this clause 13 and any Documentation, this clause 13 prevails. All disclaimers, exclusions and limitations in clauses 20–23 apply to this clause 13 to the fullest extent permitted by law.

13.12 Where the Customer is a public body or regulated entity subject to mandatory procurement or IP regimes, the Customer acknowledges that the Licensor Materials are commercial items and that any use is subject exclusively to the terms of this Agreement; any conflicting mandatory terms shall apply only to the minimum extent required by law and shall not expand the Customer’s rights in the Licensor Materials.

14. PROFESSIONAL ADVICE, COMPLIANCE AND WHERE DARITHMA FITS

14.1 The Licensor does not provide financial, accounting, legal or tax advice; the Customer is solely responsible for verifying outputs and ensuring compliance with accounting, tax and regulatory requirements, including filings, deadlines, rates, e-invoicing and record-keeping, in each case subject to clause 23.

14.2 Any compliance or localisation features are provided for convenience only and may not reflect real-time or jurisdiction-specific changes; the Customer must verify suitability, and the Licensor has no liability for the Customer’s compliance obligations, subject to clause 23.

14.3 Geographic applicability and accounting framework. DARITHMA is an accounting, invoicing and financial management system based on internationally recognised double-entry bookkeeping principles. It is designed primarily for businesses operating under the European Union’s VAT-based taxation framework, and its accounting, invoicing, VAT management, payroll and financial reporting functions are aligned with the accounting and taxation environment of Cyprus. DARITHMA is not designed for jurisdictions with substantially different indirect taxation systems, such as the United States, where state and local sales taxes apply instead of a national VAT system. Compatibility with other jurisdictions, including individual EU Member States other than Cyprus, depends on the availability and implementation of the relevant country-specific tax, invoicing and regulatory requirements; unless the Licensor states otherwise in writing, country-specific tax returns, e-invoicing formats and statutory reports of other jurisdictions are not included, and the Customer must confirm with its own advisers that the Software meets its local requirements.

14.4 Online subscriptions to the Cloud Edition are offered only to Customers whose billing address is in a country accepted in the sign-up process (at the date of this version, the Member States of the European Union). The Customer confirms that the billing address and VAT number it provides are correct. Customers elsewhere may contact the Licensor; any supply to them is subject to written terms.

15. CONFIDENTIALITY

15.1 Each Party must protect the other’s confidential information using at least the care it uses for its own similar information and may use it only to perform this Agreement.

15.2 Confidentiality does not apply to information that is public without breach, already known, independently developed or lawfully obtained.

15.3 Disclosures required by law are permitted after prompt notice where lawful and practicable, in each case subject to clause 23.

16. SUSPENSION AND TERMINATION

16.1 The Licensor may suspend access where reasonably necessary due to material breach, fraud, legal risk, infringement or security threats, with prior notice where practicable and immediate action where necessary, without liability except as provided in clause 23.

16.2 Either Party may terminate for material breach not cured within a reasonable period after written notice.

16.3 The Customer may terminate in accordance with the Subscription Terms or other commercial terms on the Website, the Order Form or written commercial terms.

16.4 Upon termination or expiry, the Customer’s licence and access cease, except that for the Cloud Edition the Subscriber may continue to sign in to download its data while the Customer Data is kept under clause 8.6; data export and deletion proceed under clauses 8 and 9.12, subject to clause 23.

17. CONSUMER MATTERS

17.1 Nothing in this Agreement excludes mandatory consumer rights where they apply under EU and Cyprus consumer law concerning digital content and digital services; where such law applies and conflicts with this Agreement, it prevails to the extent of the conflict.

17.2 Where required by law, the Licensor will supply the Service in conformity with the contract, including necessary security and functionality updates; if the Service lacks conformity, the Customer may request that it be brought into conformity, and if impossible or disproportionate, may be entitled to a price reduction or termination as provided by law.

17.3 The consumer right of withdrawal is described in clause 2.2.

18. EXPORT CONTROLS AND SANCTIONS

18.1 The Customer represents that it is not subject to EU, UK or US sanctions or listed as a restricted party.

18.2 The Customer shall not use the Service in violation of applicable export-control or sanctions laws and shall comply with applicable anti-bribery and anti-corruption laws.

19. CHANGES TO THE SERVICE AND TERMS

19.1 The Licensor may modify features or functions provided such modifications do not materially degrade the core accounting functionality of the Customer’s current plan during the then-current term, without liability except as provided in clause 23.

19.2 The Licensor may update this Agreement from time to time. For material changes, the Licensor will provide notice by email or in-app at least thirty (30) days before the change takes effect, except where a shorter period is required by law or for security reasons.

19.3 Continued use after the effective date constitutes acceptance.

19.4 If the Customer reasonably objects to a material change that materially degrades the Customer’s rights, the Customer may terminate before the change takes effect and receive a pro-rata refund of any prepaid fees for the unused part of the current billing period or Maintenance term, in each case subject to clause 23.

19.5 Price changes for the Cloud Edition are notified to the Subscriber by email at least thirty (30) days before they apply, as set out in the Subscription Terms, and the Subscriber may cancel before then.

20. WARRANTIES AND DISCLAIMERS

20.1 The Licensor warrants it has the right to grant the licence.

20.2 To the maximum extent permitted by law, the Service and all Third-Party Services are provided “as is” and “as available” without warranties of any kind, whether express, implied or statutory, including merchantability, fitness for a particular purpose, accuracy and non-infringement; any non-excludable statutory warranties are limited to the shortest duration permitted by law, and all liability remains subject to clause 23.

21. EXCLUSIONS OF LIABILITY

21.1 To the maximum extent permitted by law, the Licensor, its affiliates and suppliers shall not be liable for loss of revenue or profit; loss of goodwill, customers, capital or anticipated savings; legal, tax or accounting compliance issues; damage to reputation; loss in connection with any other contract; indirect, consequential, incidental, punitive, exemplary or special loss, damage or expense; temporary or permanent unavailability of the Service; loss, corruption or inaccuracy of data; failures due to events beyond reasonable control; reliance on outputs without independent verification; incompatibility of the Service with the Customer’s environment; unauthorised access to the Customer’s data unless caused solely by the Licensor’s gross negligence; errors or omissions in Documentation; or inaccuracies, misstatements, omissions or defects in any reports, calculations, tax documents, financial outcomes or results produced by the Software, including invoices, ledgers, financial statements, tax summaries and analytical outputs, all subject to clause 23.

22. INDEMNITIES

22.1 The Customer shall indemnify and hold harmless the Licensor, its directors and personnel against losses, costs (including reasonable legal costs), expenses, demands and liabilities arising out of a third-party claim that results from the Customer’s use of the Service, configurations or data, the Customer’s breach of this Agreement or law, or any Third-Party Service enabled by the Customer, except to the extent such loss arises from the Licensor’s breach of this Agreement or from the Licensor’s gross negligence, wilful misconduct or fraud.

22.2 The Licensor will take reasonable mitigation measures and promptly notify the Customer of the claim and cooperate reasonably at the Customer’s expense; the Customer may assume the defence and settlement provided any settlement fully releases the Licensor and imposes no obligations other than cessation of use.

22.3 Any indemnity obligations of the Licensor (if any) and any liability arising in connection with indemnified matters are subject to clause 23.

23. LIMITATION OF LIABILITY

23.1 Nothing in this Agreement excludes or limits any liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, and any non-excludable statutory rights (including, where applicable, mandatory consumer rights).

23.2 To the maximum extent permitted by law, the Licensor, its affiliates, directors, officers, employees, sub-processors, suppliers and contractors shall have no liability in contract, tort (including negligence), breach of statutory duty, misrepresentation, restitution or otherwise for: (i) loss of profit, revenue, business, contracts, opportunity, anticipated savings, goodwill, reputation or use; (ii) indirect, consequential, incidental, punitive, exemplary or special loss or damage; (iii) loss, corruption, destruction, disclosure, unavailability or inaccuracy of data, databases or software, or any failure of security, confidentiality or integrity; (iv) reliance by the Customer on any output, calculation, report, statement, reconciliation, classification, analytics, invoice, ledger, tax summary or other result generated by the Software without independent verification; (v) unavailability, interruption, delay, degradation, latency or failure of the Service or any part of it; (vi) incompatibility of the Service with the Customer’s hardware, software, network, settings or connectivity; (vii) Third-Party Services, bank feeds, data feeds, APIs, connectors or integrations (including their security, availability, accuracy, pricing, terms or continued provision); (viii) unauthorised access, account takeover, malware, ransomware, denial-of-service or other malicious acts, except to the extent caused solely by the Licensor’s wilful misconduct; (ix) the Customer’s non-compliance with accounting, tax, reporting, e-invoicing, audit or other regulatory requirements; (x) configuration errors, misuse, failure to follow Documentation, or failure to implement reasonable security (including MFA, credential hygiene and permissioning); (xi) acts or omissions of sub-processors, hosting providers, telecoms, or other suppliers, save only to the extent responsibility cannot lawfully be disclaimed under Article 28 GDPR; and (xii) any force majeure event under Clause 24.

23.3 Subject to clause 23.1, the Licensor’s total aggregate liability arising out of or in connection with this Agreement shall not exceed the total amounts actually paid by the Customer to the Licensor for the Service in the six (6) months immediately preceding the first event giving rise to the claim, excluding taxes; where the Customer has paid less than six months of amounts in that period, the cap is the amount actually paid; if no amounts were paid, the cap is zero. This cap is a single aggregate cap for all claims and causes of action, does not renew or increase by reason of multiple events, periods or claims, and applies collectively to all persons benefiting from this clause.

23.4 For loss or corruption of data, the Licensor’s sole obligation is to take reasonable steps to attempt recovery from available backups, and any liability arising is subject to the aggregate cap above.

23.5 Any liability in connection with sub-processors or other third-party providers is, to the extent permitted by law, limited to the Licensor’s obligations as a processor under Article 28 GDPR and, in all events, is subject to this clause 23.

23.6 All remedies of the Customer under or in connection with this Agreement are, to the fullest extent permitted by law, limited to the remedies expressly set out herein; service credits (if any) and the foregoing aggregate cap are the Customer’s sole and exclusive monetary remedies for any failure or shortfall of the Service.

23.7 Any implied indemnities or warranties (to the extent they cannot be disclaimed) and any liability arising from them are subject to this clause 23.

23.8 The exclusions and limitations in this clause apply regardless of the cause of action or legal theory, whether or not the Licensor has been advised of the possibility of such loss or damage, and even if any remedy fails of its essential purpose.

23.9 Any claim arising out of or in connection with this Agreement must be commenced within twelve (12) months after the date on which the cause of action accrued; after that time, the claim is permanently barred to the extent permitted by law.

23.10 The Parties agree that the allocations of risk, exclusions and limitations in this clause 23 are reasonable and form an essential basis of the bargain reflected in this Agreement.

24. FORCE MAJEURE

24.1 Neither Party is liable for delay or failure to perform due to events beyond reasonable control, including internet or hosting outages, denial-of-service attacks, acts of God, war, labour disputes, governmental actions or failures of suppliers or Sub-processors caused by such events; timeframes are extended for the period of the event and necessary recovery.

25. NOTICES

25.1 Notices must be in writing and sent by email to the Customer’s designated administrative email and to info@darithma.com, or by registered post or courier to the addresses in the preamble or Order Form.

25.2 Notices are deemed delivered upon receipt, and for email when sent unless a delivery failure notice is received.

25.3 Operational communications, security alerts and service updates may be provided in-app or by email to the administrative email, and the Customer may contact support at support@darithma.com.

26. ASSIGNMENT AND SUBCONTRACTING

26.1 The Customer may not assign this Agreement without the Licensor’s prior written consent, not to be unreasonably withheld.

26.2 The Licensor may assign this Agreement in connection with a merger, acquisition, corporate reorganisation or sale of substantially all assets, and may subcontract obligations, including to Sub-processors, remaining responsible for their performance, subject to clause 23.

27. PRECEDENCE, SEVERABILITY, WAIVER, RELATIONSHIP

27.1 In the event of conflict, the following order applies: first, the Subscription Terms, the Purchase Confirmation or the Order-Form commercial terms accepted at the time of purchase or otherwise agreed in writing by the Licensor and the Customer; second, the data-protection terms in clause 9 (and any referenced transfer mechanisms solely for transfers); third, this Agreement; fourth, the Documentation.

27.2 If any term is held invalid, the remainder remains in effect and the term shall be enforced to the maximum extent permitted.

27.3 A failure to enforce is not a waiver of future enforcement.

27.4 The Parties are independent contractors.

28. GOVERNING LAW AND JURISDICTION

28.1 This Agreement is governed by the laws of the Republic of Cyprus.

28.2 The courts of Cyprus have exclusive jurisdiction for all disputes, without prejudice to any mandatory consumer forum rights where consumer law applies.

28.3 The Parties may by mutual agreement refer disputes to mediation in Cyprus prior to litigation.

29. ENTIRE AGREEMENT

29.1 This Agreement, together with its Annexes and any documents incorporated by reference, constitutes the entire agreement between the Parties regarding its subject matter and supersedes all prior agreements, understandings and representations, whether written or oral.

30. CONSENT PRIOR TO USE

30.1 By selecting “I agree” and proceeding, the Customer confirms acceptance of these terms and requests immediate access to the Service, acknowledging the consumer withdrawal position where applicable.

ANNEX A — DATA PROCESSING ADDENDUM (PROCESSOR TERMS)

(i) For Customer Data, the Customer is the Controller and DARITHMA LTD is the Processor; no joint controllership is created. This Annex applies to the Cloud Edition, and to the Desktop Edition only where the Licensor processes Customer Data in providing support or Maintenance, and solely when DARITHMA LTD acts as Processor and prevails over the Agreement for those Processor activities only; otherwise the Agreement governs.

(ii) The Processor processes Customer Data only to provide, secure, support and operate the Service for the Customer, including storage, transmission, display, backup, troubleshooting, monitoring, telemetry and tenant-scoped improvements, for the authorised term and until deletion or return in accordance with this Annex.

(iii) Customer Data typically includes business-context personal data relating to the Customer’s personnel, contractors, end clients, suppliers and contacts (including identifiers, contact details, role/permissioning, usage logs, the company audit trail of changes (user, time and IP address) and transaction metadata). Special-category or criminal-offence data must not be submitted unless expressly agreed in a signed writing with appropriate safeguards; if received inadvertently, the Processor may redact or delete it.

(iv) The Processor acts only on the Controller’s documented instructions, which include this Annex and Agreement, in-app/admin settings and written support requests. The Processor may decline or suspend any instruction that appears unlawful, unclear, infeasible or unsafe pending clarification. The Controller shall give timely, clear instructions via secure channels and shall not transmit credentials or sensitive data in unprotected media.

(v) The Controller is solely responsible for determining the lawfulness of processing; providing all required notices and obtaining/recording any consents; performing DPIAs and consultations where required; configuring the Service appropriately (including security settings, MFA, permissions and retention); restricting access to authorised users; and ensuring data minimisation and accuracy. Free-form fields must not be used to store special-category or criminal-offence data unless expressly agreed as above.

(vi) Personnel of the Processor with access to Customer Data are bound by appropriate confidentiality obligations and access is restricted to those with a need to know.

(vii) The Processor maintains technical and organisational measures appropriate to risk as described in Annex B (TOMs) and updated from time to time to reflect evolving threats and industry practice. These obligations apply to systems under the Processor’s control. Where the Customer uses a Downloadable Component or otherwise processes data in its own environment, the Customer is solely responsible for local security, backups, continuity and updates; incidents in the Customer’s environment are the Customer’s responsibility.

(viii) The Controller authorises the Processor to engage Sub-processors for hosting and ancillary services. As of the date of this version, the Processor uses the following Sub-processors: (a) Hetzner Online GmbH, Germany — hosting of the Cloud Edition on servers in Germany; (b) DigitalOcean, LLC — storage of encrypted backups and a standby server, in its Frankfurt (Germany) data centre; and (c) Namecheap, Inc. (Private Email) — sending of emails generated by the Software, including documents the Customer chooses to email from DARITHMA. Card payments and billing are handled by Stripe for the Licensor’s own billing and do not involve Customer Data (Annex C). AI services used with the Customer’s own account or key are Third-Party Services of the Customer (clause 12.4), not Sub-processors. The Processor imposes written data-protection terms no less protective and remains responsible for its obligations under Article 28 GDPR. The Processor will provide at least 15 days’ prior notice of material Sub-processor changes and the Controller may raise a reasonable, good-faith objection; if unresolved, the Controller’s sole remedy is to terminate the affected service and receive a pro-rata refund of any prepaid fees for the remaining term. To obtain the then-current list of Sub-processors at any time, the Controller may email info@darithma.com and the Processor will provide the list upon request. Any liability in connection with Sub-processors is subject to clause 23 of the Agreement.

(ix) Where processing involves transfers outside the EEA/UK without an adequacy decision, recognised transfer mechanisms will be used (including the EU Standard Contractual Clauses and, where applicable, the UK Addendum/IDTA) together with appropriate supplementary measures; such mechanisms prevail solely for the relevant transfers in case of conflict. Successor or replacement transfer tools may be adopted as lawfully permitted.

(x) Taking into account the nature of processing and the information available, the Processor will reasonably assist the Controller with security obligations, DPIAs, prior consultations and responses to data-subject requests to the extent the Controller cannot address such matters via available product features. The Controller shall first use available self-service tooling. Assistance beyond standard tooling is provided on a time-and-materials basis at reasonable rates and only with respect to information under the Processor’s control.

(xi) Upon becoming aware of a confirmed Personal Data Breach affecting Customer Data in systems under the Processor’s control, the Processor will notify without undue delay and provide information then reasonably available to aid the Controller’s assessment and notifications; such notice is not an admission of fault or liability. Incidents originating in or confined to the Customer’s environment (including Downloadable Components, networks, devices or credentials) are the Controller’s responsibility; the Processor will reasonably cooperate subject to this Annex and may charge reasonable fees.

(xii) The Processor will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR, which may include current third-party certifications, independent reports and responses to standard security questionnaires. If reasonably required, the Controller may conduct an audit no more than once in any 12-month period on 30 days’ written notice during normal business hours, subject to confidentiality, safety and security requirements. The Processor may first satisfy audit needs through remote and documentary review; on-site components are permitted only if remote/documentary review is insufficient. Audits must avoid disruption and exclude third-party confidential information. The Controller bears all audit costs and the Processor’s reasonable out-of-pocket costs; remediation timelines shall be reasonable and risk-based.

(xiii) Upon termination or upon written request, the Processor will make available reasonable means to export Customer Data and will delete or irreversibly anonymise Customer Data from active systems within a reasonable period following confirmation, with residual copies expiring per backup cycles. Minimal business records and compliance evidence (including invoicing data and security logs evidencing compliance) may be retained for legally permitted periods. Deletion timelines will broadly align with clauses 8.4-8.5 of the Agreement where feasible.

(xiv) If the Processor receives a legally binding demand for Customer Data, it may disclose to the extent strictly required by law and, where lawful and practicable, will provide prior notice to the Controller. The Processor will challenge overbroad demands where reasonable.

(xv) The Processor will maintain records required by Article 30(2) GDPR for processing carried out on behalf of the Controller.

(xvi) All warranties, exclusions and limitations in clauses 20–23 of the Agreement apply to this Annex to the fullest extent permitted by law. Nothing in this Annex increases the Processor’s liability or creates additional remedies beyond the Agreement. Without limiting the Controller’s broader obligations under the Agreement, the Controller is responsible for fines, claims or losses arising from Customer instructions or Customer-side processing that breach data-protection laws, except to the extent caused solely by the Processor’s wilful misconduct.

(xvii) The Processor may update TOMs and Sub-processors over time to maintain appropriate protection and service quality; material adverse reductions in protection will be avoided. Where a change materially reduces protection, the Controller may object as described in paragraph (viii).

(xviii) The Processor may create and use aggregated or anonymised statistics derived from the Customer’s use for security, reliability, analytics and improvement, provided such data does not identify the Controller or any data subject.

(xix) Capitalised terms have the meanings given in the Agreement. Governing law and jurisdiction are as set out in clause 28. If any provision of this Annex is held invalid, the remainder remains in effect and shall be enforced to the maximum extent permitted. This Annex may be executed, incorporated or accepted electronically.

ANNEX B — TECHNICAL AND ORGANISATIONAL MEASURES (TOMs)

(i) Governance and access: least-privilege access; unique credentials; role-based permissions; two-factor authentication on administrative systems and service accounts; two-factor sign-in available to users of the Cloud Edition.

(ii) Network and hosting: EU-hosted infrastructure (Hetzner, Germany) with a firewall, administrative access by SSH keys only, and regular patching; services not publicly exposed unless required.

(iii) Encryption: TLS for data in transit; encrypted backups; secure handling of keys; API keys of customers stored encrypted.

(iv) Application security: secure coding practices, dependency management, CSRF protection, input validation, session security, rate limits on sign-in and sign-up; a separate database for each company.

(v) Logging and monitoring: system and service logs retained for a limited period for security and troubleshooting; availability monitoring and alerts on critical failures; the content of scanned documents is not written to logs.

(vi) Backups and continuity: encrypted backups made daily and stored with a second, independent provider (DigitalOcean, Frankfurt), with rolling retention; a standby server that can be brought into service from the latest backup; periodic restore drills.

(vii) Incident response: documented process for identification, containment, eradication and recovery; post-incident review.

(viii) Sub-processor oversight: contractual safeguards and onboarding/review.

(ix) Licensing and support systems: the measures above apply also to the systems the Licensor uses for licence activation, billing and support of both editions.

ANNEX C — PRIVACY POLICY (CONTROLLER SIDE)

(i) Version 2.0, 29 October 2026. Controller: DARITHMA LTD (Cyprus Reg. HE476166), Gerolakkou Avenue 6A, 8540 Paphos, Cyprus. Contact: info@darithma.com. Competent supervisory authority: Office of the Commissioner for Personal Data Protection (Cyprus).

(ii) This Annex governs processing where DARITHMA LTD acts as Controller (including the Website and its forms, account creation, subscription management, billing, support, operations, Desktop licensing and marketing). When you use the Software to process your own business/customer data, you are the Controller and we act as Processor; Annex A (Data Processing Addendum) governs those Processor activities and prevails in the event of conflict.

(iii) As Controller we collect Personal Data such as: account and identity data (e.g., name, username, email, role, organisation); subscription and billing data (billing address, VAT/tax IDs, plan and payment status — payment card data is processed by our payment provider and we do not store full card numbers); Desktop licensing data (licence identifiers, the hardware identifier of the licensed computer, licence and Maintenance status); data sent through the forms on the Website (name, company, email, telephone, message, and the IP address and time of sending); support and operations data (communications and troubleshooting material you provide); and technical and security data (IP address, browser details, timestamps, sign-in and acceptance records, diagnostics). We collect data directly from you, automatically through our services, and from service providers (e.g., payments and email delivery). We may create aggregated or anonymised statistics that do not identify you.

(iv) We process Personal Data as Controller for the following purposes and legal bases: contract (to provide, administer and support accounts, subscriptions, licences, billing and service communications, and to answer requests sent through the Website); legal obligation (tax/VAT, accounting, fraud prevention and compliance, responding to lawful requests); legitimate interests (securing and protecting services and users, preventing abuse, diagnostics and improvement, contacting you about services similar to those you already use — opt out at any time); and consent where the law requires it (for example for marketing), withdrawable at any time without affecting prior lawful processing. For Processor activities within your tenant, our authority is your documented instructions under Annex A.

(v) Cookies: the Website does not use cookies for analytics or advertising. DARITHMA Cloud uses only cookies that are strictly necessary: a session cookie that keeps the user signed in, a security cookie that protects forms (CSRF), a short-lived cookie used while a file is downloaded, and, on the card-verification page, cookies set by our payment provider (Stripe) for fraud prevention. The sign-up and password-reset pages use a security check by Cloudflare (Turnstile).

(vi) We do not sell Personal Data. We share Personal Data with service providers under written data-protection terms, only as needed for the purposes above: Hetzner Online GmbH (hosting, Germany); DigitalOcean, LLC (encrypted backups and standby server, Frankfurt); Stripe Payments Europe, Limited (payments, invoices and VAT calculation); Namecheap, Inc. (email and the Website’s domain); Cloudflare, Inc. (hosting of the Website and the Turnstile security check); and Google (fonts loaded by the Website and previews of our videos on YouTube). We may also disclose information where required by law, in response to lawful requests, to protect rights, safety and security, to prevent fraud or abuse, or in connection with a corporate transaction (merger, acquisition or restructuring).

(vii) Where Controller-side processing involves transfers outside the EEA/UK without an adequacy decision, we use recognised transfer mechanisms (including the EU Standard Contractual Clauses and, where applicable, the UK Addendum/IDTA), together with appropriate supplementary measures; those mechanisms prevail solely for the relevant transfers in case of conflict.

(viii) We implement technical and organisational measures appropriate to risk (including TLS in transit, access controls, logging/monitoring, vulnerability and patch management, and encrypted daily backups). No system is perfectly secure; obligations and limitations in the Agreement (including clause 23) apply. You are responsible for securing the credentials and devices you use to access our services and for your local environment.

(ix) We retain Personal Data no longer than necessary for the purposes above, including to comply with legal, accounting and tax requirements, to resolve disputes and to enforce agreements. Typical retention includes account/billing records for legally required periods; support records for operational needs and legal retention; and logs/telemetry for limited security/diagnostic periods. Aggregated/anonymised data may be retained without time limit.

(x) Subject to applicable law and exemptions, you may request access, rectification, erasure, restriction, portability and objection (including objection to direct marketing). You may withdraw consent at any time where processing is based on consent. To exercise rights, contact info@darithma.com; we may need to verify identity and authority and may refuse manifestly unfounded or excessive requests or charge a reasonable fee to cover administrative costs, as permitted by law. You have the right to lodge a complaint with the Cyprus supervisory authority.

(xi) We may send communications about services similar to those you already use under our legitimate interests; you can opt out at any time via the message or by contacting us. Where required by law, we will obtain consent before sending marketing communications.

(xii) Our websites and services may contain links or integrations to third-party sites or services with their own privacy practices; we are not responsible for those practices. When you provide us with Personal Data of others, you represent that you have a lawful basis and appropriate notices/consents. Your processing of Customer Data in the Software (your tenant) is governed by Annex A; you are responsible for providing required notices to data subjects and for your configuration and use.

(xiii) Please do not include special-category or criminal-offence data in free-form fields, attachments or support materials unless we expressly request it with appropriate safeguards; if received inadvertently, we may redact or delete it to reduce risk.

(xiv) We do not carry out automated decision-making producing legal or similarly significant effects without providing required notices and safeguards; if we introduce such processing, we will provide appropriate information and choices in advance.

(xv) We may update this Privacy Policy (Controller Side) from time to time; material changes will be notified by email and/or in-app before they take effect. Continued use after the effective date constitutes acceptance of the updated policy.

(xvi) This Annex is subject to the Agreement (including clauses 20–23 on warranties, exclusions and limitations of liability). Nothing in this Annex creates any additional warranties or remedies beyond those set out in the Agreement, and, for Processor activities, Annex A controls.

ANNEX D — MODEL WITHDRAWAL FORM (CONSUMERS ONLY)

Complete and return this form only if you are a consumer and wish to withdraw from the contract (clause 2.2).

DARITHMA LTD · Terms of Use · Version 2.0 · 29 October 2026